Bristol City Council

Summary

Hackers infiltrated Bristol City Council's Trading with Schools platform with malicious software, compromising data from 39 schools that rely on the system for scheduling, lesson plans, staff details, payroll, and sensitive information about children including educational psychology files. More than 320,000 stolen files were later published on the dark web, while the broader platform serves 88 schools, 49 of which only use it for internet services. After the breach was detected, the system was shut down, leaving many schools without phone service and forcing teachers to work longer hours to deliver lessons. The authority stated it could not confirm the specific data details and said officers were reviewing the material to determine what was affected and notify families. The South West Regional Organised Crime Unit is investigating the attack.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

The cyber attack on Bristol City Council's Trading with Schools platform began when malicious software infiltrated the system on 21 September. The authority became aware of the intrusion four days later and shut down the platform on 25 September. Trading with Schools is used by 88 schools under the council's umbrella. Of those, 49 schools purchased only internet services, while the remaining 39 relied more heavily on the platform for day-to-day tasks such as scheduling, lesson plans, recording staff details, and payroll information. The platform can also house sensitive information about children, including educational psychology files. More than 320,000 files stolen from those 39 schools were subsequently found on the dark web. The BBC understands that only Bristol schools were impacted by the breach.

Since the system was shut down on 25 September, many affected schools have been unable to use their phones. Teachers have faced longer working hours as they struggle to find alternative ways to deliver their lessons. Head teachers have been informed about the development and are issuing guidance to families at the affected schools. Bristol City Council said it was unable to confirm the details of the stolen data at the time of reporting. Vik Verma, the council's director of education, stated that officers were working through a large amount of material as quickly as possible to determine the nature of the data published and would update families in due course. He acknowledged the distress this could cause the school community in the city.

The South West Regional Organised Crime Unit is investigating the cyber attack. The council said it was ensuring schools, families, and staff had clear advice on the practical steps they can take to protect themselves online. Officials encouraged everyone to remain vigilant and be cautious of unexpected messages, emails, or phone calls. A parent with a child at Ashley Down School in Bristol, which uses the platform, described feeling concerned, disappointed, and shocked that she had only just received an update from the council. She said she felt sorry for the schools involved.

Sources

Sources available to members: 1 source.